Red Hat Security AdvisoryRHSA-2016:0722
openssl security update
Released 2016-05-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-51.el7_2.5, openssl-libs-1:1.0.1e-51.el7_2.5
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-51.el7_2.5, openssl-perl-1:1.0.1e-51.el7_2.5, openssl-static-1:1.0.1e-51.el7_2.5
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-51.el7_2.5, openssl-libs-1:1.0.1e-51.el7_2.5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-51.el7_2.5, openssl-perl-1:1.0.1e-51.el7_2.5, openssl-static-1:1.0.1e-51.el7_2.5
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-51.el7_2.5, openssl-devel-1:1.0.1e-51.el7_2.5, openssl-devel-1:1.0.1e-51.el7_2.5.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-51.el7_2.5, openssl-static-1:1.0.1e-51.el7_2.5, openssl-static-1:1.0.1e-51.el7_2.5.ppc
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-51.el7_2.5, openssl-devel-1:1.0.1e-51.el7_2.5, openssl-libs-1:1.0.1e-51.el7_2.5
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-51.el7_2.5, openssl-static-1:1.0.1e-51.el7_2.5
Fixes 7 records
Priority HIGH 82
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafte…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.77906 · Published 2016-05-05 · Partial fix CWE-119
Priority HIGH 74
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of servic…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.53655 · Published 2016-03-03 · Partial fix CWE-119
Priority HIGH 69
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.89058 · Published 2016-05-05 · Partial fix CWE-200
Priority HIGH 67
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bou…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.32414 · Published 2016-03-03 · Partial fix CWE-119
Priority MEDIUM 60
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount o…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.3965 · Published 2016-05-05 · Partial fix CWE-190
Priority MEDIUM 56
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a sh…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.2921 · Published 2016-05-05 · Partial fix CWE-399
Priority MEDIUM 55
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.27261 · Published 2016-05-05 · Partial fix CWE-189
THREATIST.IORead the docs